Privacy Policy

Last updated: 1 November 2026

1. Who we are

Bren’s Table (“we”, “us”, “our”) is an AI-powered tabletop roleplaying game available at brens-table.vercel.app (the “Service”). It is run by an individual sole trader based in the United Kingdom, who is the controller of your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Because the Service is offered to players in the European Union and European Economic Area, we also follow the EU General Data Protection Regulation (EU GDPR) for those players. We are the “business” under US state privacy laws such as the California Consumer Privacy Act (CCPA), and the organisation accountable for your information under Canada’s PIPEDA and Quebec’s Law 25. The operator is also the person in charge of protecting personal information for the purposes of Quebec’s Law 25, and can be reached at the details below.

• Operator: a sole trader in the United Kingdom, trading as Bren’s Table
• Email: brenstable@gmail.com
• Postal address: being set up, listed here soon

This policy explains what personal data we collect when you use the Service, why, who we share it with, how long we keep it, and the rights you have. It should be read together with our Terms of Service.

2. Information we collect

2.1 Information you give us

• Account information. When you sign in with Google, Google shares your name, email address, profile picture and a Google account identifier with us. These are stored by our authentication provider, Supabase. We do not receive your Google password or access to anything else in your Google account.
• Rounds. How many free and bought rounds your account has, when its free rounds next refill, and a log of each round spent or added (with the time), and the dice skins and backgrounds you’ve bought. Supabase stores these with your account so the limit is the same on every device.
• Purchases. If you buy rounds, which plan you bought or subscribe to, when, how many rounds it added, and the identifiers Stripe gives your payments and your customer record, so we can add the rounds and let you manage your plan. Stripe collects your card or other payment details, billing name, email, country and postal code directly on its own checkout page; we receive only those identifiers and the payment’s status, never your full card number.
• Characters and campaigns. Character names, descriptions, backstories, classes, inventory, story history and choices, and your character’s portrait. They are saved in your browser’s local storage and, when you’re signed in, Supabase keeps a copy with your account so you can carry on from any device.
• What you type during play. Your actions, dialogue and other text you send to the storyteller. This is passed through our server to our AI provider to generate Bren’s reply (see section 6).
• Portrait descriptions. The description, class and backstory of your character, which we turn into a prompt for our image provider to paint your portrait.
• Age confirmation. Your confirmation that you are 18 or over, saved in your browser.
• Messages to us. If you email us for support, feedback or to exercise your rights, we keep that correspondence.

2.2 Information collected automatically

• IP address. Each request to our game servers carries your IP address. We use it to limit how many requests one connection can make per minute, to stop abuse and runaway costs. That count is held in memory for about a minute and is not stored.
• Server logs. Our hosting provider, Vercel, records standard request logs (IP address, time, page or endpoint requested, browser type, and error messages) to run and secure the Service. These are kept for a short period under Vercel’s retention settings.

2.3 What we don’t collect

• Your full card number or security code. These go straight to Stripe and are never sent to or stored by us.
• Analytics, advertising or social-media tracking data, unless you accept ads cookies (the Meta Pixel, see sections 3 and 5).
• Your precise location, contacts, or any special category data on purpose.

Please don’t include real personal information about yourself or anyone else (for example health details or someone’s real name and address) in your stories. Everything you type is sent to our AI provider.

3. Cookies and browser storage

Bren’s Table stores small pieces of information in your browser (cookies, local storage and session storage). Under the Privacy and Electronic Communications Regulations (PECR), storage that is strictly necessary to provide the Service you asked for does not need consent; anything else does.

Everything we store is strictly necessary or remembers a choice you made, except the Meta Pixel. The Meta Pixel is an advertising tool from Meta (the company behind Facebook and Instagram). It loads only after you click Accept on our cookie banner, and never if your browser sends a Global Privacy Control signal. It tells Meta which of our pages you visit, when you create an account and when you buy rounds, so we can see which of our ads bring players to the table and show our ads to people likely to enjoy it. Our server sends Meta the same events (Meta’s Conversions API), with your email address and account ID scrambled (hashed) first, so Meta can match them to the ad you saw. If you click Reject, the Pixel never loads and our server sends Meta nothing. If you change your mind later, the Pixel stops and its cookies are deleted.

Music. If you turn the music on, the track is streamed from incompetech.com, which will see your IP address like any website you visit. Nothing is loaded from there while the music is off.

You can change your cookie choice at any time with the buttons above, and you can clear everything Bren’s Table stores with Profile → Erase data in the game or through your browser’s settings. Signed in, Erase data deletes your account and the campaigns saved with it; clearing your browser’s storage leaves those in your account.

4. How we use your information, and our lawful bases

The UK GDPR and the EU GDPR require us to have a lawful basis for each use of your personal data. Ours are below. In Canada, we rely on your consent, which you give when you sign in and play and can withdraw at any time (see section 9.4).

We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects. The AI decides what happens in your story; it doesn’t decide anything about you.

5. Who we share it with

We do not sell your personal data. We use the following service providers (“processors”), who handle data only on our instructions and under contracts that protect it. The one exception is Meta, below, which we only share with if you accept ads cookies.

For the Meta Pixel and Conversions API, Meta Platforms Ireland Ltd. and we are joint controllers for collecting and sending this data to Meta, under Meta’s Controller Addendum; Meta is responsible for what it does with the data afterwards, under its own privacy policy.

We may also share information:

• when the law requires it, or to protect the rights, safety or property of our players, ourselves or others;
• with a buyer or successor if the Service is sold or transferred, who must honour this policy;
• with your consent, or at your direction.

6. AI processing and international transfers

Bren’s stories are written by Claude, a model made by Anthropic, and portraits are painted by an image model run by fal.ai. To generate them, your inputs are sent to these providers through their business APIs. We don’t train or fine-tune any AI model on your content, and Anthropic does not train its models on data sent through its commercial API. Our providers may keep inputs and outputs for a limited time to operate their service and to detect misuse, under their own policies.

Where your data goes

• European Union. Your account (name, email, profile picture, Google account ID), your rounds and your saved campaigns are stored by Supabase in Frankfurt, Germany.
• United States. Your story turns and character details go to Anthropic, and your portrait descriptions go to fal.ai, both in the US. Our host Vercel, Google’s sign-in service and our payment processor Stripe also process data in the US and on their global networks.
• Your browser. A copy of your campaigns is kept on your own device too.

So if you play from the UK, the EU or EEA (including Sweden, Norway, Denmark, Finland and Iceland) or Canada, your data will be transferred to and processed in the United States, outside your country. US law may allow US authorities to access data held there.

How transfers are protected

• From the EU and EEA: we rely on the European Commission’s adequacy decision for the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission’s Standard Contractual Clauses in the provider’s data processing terms (Article 46 GDPR), with the extra security measures those providers apply. Data stored in Frankfurt stays inside the EU.
• From the UK: we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, where the provider is certified) or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. The EU is covered by UK adequacy regulations, so storage in Frankfurt needs no extra safeguard.
• From Canada: our providers are bound by contract to protect your information to a standard comparable to Canadian law and to use it only to provide their service to us. While your information is outside Canada it is subject to the laws of the country where it is held.

You can ask us for more information about these safeguards, or a copy of them, at any time.

7. How long we keep it

• Campaigns are kept with your account until you burn them, and are deleted with your account. Preferences stay in your browser until you clear them or the browser removes them.
• Account information and rounds are kept while your account exists. Delete your account with Profile → Erase data and they are deleted straight away; if you ask us by email instead, we delete them within 30 days.
• Purchase records we keep are deleted with your account. Stripe keeps its own records of your payments for as long as tax, accounting and anti-fraud law requires (in the UK, generally at least six years), and we may keep what those laws require of us for the same time.
• A fingerprint of your sign-in is kept after your account is deleted, to prevent abuse of the free rounds: a one-way hash of your Google or Apple account id (never your email or name) and the date you first signed up. It can't be turned back into your account id, and it is only used so that a new account signing in the same way carries on the old account's free-round cycle instead of starting a new one. We rely on our legitimate interest in preventing fraud.
• IP addresses for rate limiting are held in memory for about a minute.
• Server logs are kept for a short period under our host’s retention settings, then deleted.
• Story and portrait requests aren’t stored by us after the reply is returned. Our AI providers may keep them for a limited time under their own retention policies.
• Emails to us are kept for as long as needed to deal with your message, and up to two years after.

8. Security

We use HTTPS for all traffic, keep API keys on the server and never in the game itself, limit request rates, restrict who can access our provider accounts, and use providers who encrypt data in transit and at rest. No system is perfectly secure, so we can’t guarantee absolute security, but if a breach puts your rights at risk we will tell you and the regulator that oversees your data (in the UK, the Information Commissioner’s Office) as the law requires.

9. Your rights

Your rights depend on where you live. Whatever the law where you are, you can always ask us what we hold about you, have it corrected, or have your account deleted, by emailing brenstable@gmail.com from the address linked to your account. It’s free. We may need to confirm it’s really you first, and we’ll tell you if we can’t do something and why. You can also delete your account yourself at any time with Profile → Erase data: your account, your rounds and their log are deleted from our servers at once, and so is everything the game keeps in that browser.

10. Age requirement

Bren’s Table is for adults aged 18 and over. Its stories can include violence, dark themes and mature content, and it is not designed for or directed at children. We don’t knowingly collect personal data from anyone under 18. If you believe a child has used the Service, contact us at brenstable@gmail.com and we will delete their account.

11. Other websites

The Service links to other sites, such as our providers’ privacy policies and app stores. Their privacy practices are their own; please read their policies.

12. Changes to this policy

We’ll update this policy when the Service changes, for example if we add analytics. The date at the top shows the latest version. If a change significantly affects how we use your data, we’ll tell you in the game or by email before it takes effect.

13. Contact

For any question about this policy or your personal data:

• Operator: a sole trader in the United Kingdom, trading as Bren’s Table
• Email: brenstable@gmail.com
• Postal address: being set up, listed here soon